scriptoriumadmin/featurebase
1
0
Fork 0
mirror of https://github.com/featurebasedb/featurebase.git synced 2026-08-28 10:54:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix UUID library version for CVE-2021-3538 (#2213)

Browse source 
We were using v1.2.0 of the github.com/satori/go.uuid library to
generate UUIDs for transactions if the transaction had no previous id.

That version of the library had CVE-2021-3538: "Due to insecure
randomness in the g.rand.Read function the generated UUIDs are
predictable for an attacker."

More reading can be done here:
https://pkg.go.dev/vuln/GO-2022-0244
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3538

This vulnerability was found using the new govulncheck tool which is not
currently used in our CI pipeline but might be a good candidate to
include in the future. (Like all tools like this there are caveats to
its usage and utility which can be read about below.)

Information on that tool can be found here:
https://go.dev/blog/vuln
https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
This commit is contained in:
Garrison Davis 2022-09-06 13:52:13 -06:00 • committed by GitHub
parent 7c936471cc
commit 1469f4a72c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -48,7 +48,7 @@ require (
github.com/rakyll/statik v0.1.7
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
github.com/ricochet2200/go-disk-usage/du v0.0.0-20210707232629-ac9918953285
github.com/satori/go.uuid v1.2.0
github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76
github.com/segmentio/kafka-go v0.4.29
github.com/shirou/gopsutil/v3 v3.22.5
github.com/spf13/cobra v1.2.1

3
go.sum
View file

@ -979,8 +979,9 @@ github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFo
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76 h1:ofyVTM1w4iyKwaQIlRR6Ip06mXXx5Cnz7a4mTGYq1hE=
github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtmuhtR2uUrrJOpYzYRvbcPAid+g=
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
github.com/segmentio/kafka-go v0.4.29 h1:4ujULpikzHG0HqKhjumDghFjy/0RRCSl/7lbriwQAH0=

6
server.go
View file

@ -1319,7 +1319,11 @@ func (srv *Server) StartTransaction(ctx context.Context, id string, timeout time
// empty string id should generate an id
if id == "" {
id = uuid.NewV4().String()
uid, err := uuid.NewV4()
if err != nil {
return nil, errors.Wrap(err, "creating id")
}
id = uid.String()
}
trns, err := srv.holder.StartTransaction(ctx, id, timeout, exclusive)
if err != nil {